← CVE index
Vulnerability record/PUBLISHED/Published Nov 12, 2026 06:21:04 UTC

CVE-2026-8331

An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.

Base score8.8/ 10
SeverityHighCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsPresentAT
Privileges requiredLowPR
User interactionActiveUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityHighVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityHighSC
Subsequent system integrityHighSI
Subsequent system availabilityHighSA
CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityMicrochip
Last updatedNov 12, 2026 07:56:38 UTC
PublishedNov 12, 2026 06:21:04 UTC
ReservedMay 11, 2026 15:27:37 UTC

Credits

  • Dario Emilio Bertani
  • Andrea Sindoni
  • Antonio Carriero
  • Marco Manieri
  • Vito Pistillo
  • Davide Renna
  • Manuel Leone
  • TIM Security Red Team Research